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IN THE CLAIMS: 



1 1 . (ORIGINAL) A method for implementing port-based network access control at a 

2 shared media port in an intermediate node, the shared media port being coupled to a plu- 

3 rality of client nodes, the method comprising: 

4 partitioning the shared media port into a plurality of logical subinterfaces, each 

5 logical subinterface dedicated to providing access to a different network or subnetwork 

6 accessible through the intermediate node; 

7 receiving a data packet at the shared media port from a first client node; 

8 associating the received data packet with a first logical subinterface in the plural- 

9 ity of logical subinterfaces; 

10 determining whether the first client node is authenticated to communicate over the 
n first logical subinterface' s dedicated network or subnetwork; and 

12 if the first client node is determined to be authenticated to communicate over the 

13 first logical subinterface 's dedicated network or subnetwork, forwarding the received 

14 data packet over the first logical subinterface' s dedicated network or subnetwork. 

1 2. (ORIGINAL) The method according to claim 1, further comprising: 

2 performing at least one of dropping the received data packet or reclassifying the 



3 received data packet to a different logical subinterface, if the first client node is deter- 

4 mined not to be authenticated to communicate over the first logical subinterface 's dedi- 

5 cated network or subnetwork. 

1 3. (ORIGINAL) The method according to claim 1, wherein the first logical subinterface 's 

2 dedicated network or subnetwork is a virtual private network (VPN). 

1 4. (ORIGINAL) The method according to claim 1, wherein a logical subinterface in the 

2 plurality of logical subinterfaces is dedicated to providing access to the Internet. 
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1 5. (ORIGINAL) The method according to claim 1, wherein the step of determining 

2 whether the first client node is authenticated to communicate over the first logical subin- 

3 terface's dedicated network or subnetwork further comprises: 

4 parsing a source media access control (MAC) address from the received data 

5 packet; 

6 indexing an entry in a MAC filter associated with the shared media port based on 

7 the value of the parsed source MAC address; 

8 identifying an authentication state stored in the indexed MAC-filter entry; and 

9 determining whether the first client node is authenticated to communicate over the 



10 first logical subinterface's dedicated network or subnetwork based on the authentication 

n state stored in the indexed MAC-filter entry. 

1 6. (ORIGINAL) The method according to claim 5, wherein the MAC filter is organized 

2 as a hash table. 

1 7. (ORIGINAL) The method according to claim 1 , further comprising: 

2 parsing a destination Internet Protocol (IP) address from the received data packet; 

3 comparing the parsed destination IP address to one or more IP addresses stored in 

4 an IP filter associated with the shared media port; and 

5 if the parsed destination IP address matches an IP address stored in the IP filter, 

6 forwarding the received data packet over the first logical subinterface's dedicated net- 

7 work or subnetwork, even if the first client node is determined not to be authenticated to 

8 communicate over that network or subnetwork. 

1 8. (ORIGINAL) The method according to claim 1 , wherein the step of associating the 

2 received data packet with the first logical subinterface, further comprises: 

3 locating an entry in a routing table configured to store routing information associ- 

4 ated with the received data packet; and 
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5 associating the received data packet with the first logical subinterface based on 

6 the contents of the routing-table entry. 

1 9. (ORIGINAL) The method according to claim 1, further comprising: 

2 receiving an authentication request from the first client node at the shared media 

3 port; 

4 in response to receiving the authentication request, creating a MAC filter associ- 

5 ated with the shared media port if the MAC filter has not already been created; 

6 copying a source MAC address stored in the received authentication request into 

7 an appropriate entry in the MAC filter; 

8 forwarding the received authentication request to an authentication service; 

9 receiving a response from the authentication service, the response identifying an 

10 authentication state associated with the first client node; and 

1 1 storing the authentication state into the same MAC-filter entry into which the 

12 source MAC address was copied. 

1 10. (ORIGINAL) The method according to claim 9, wherein the step of copying the 

2 source MAC address into an appropriate MAC-filter entry further comprises: 

3 indexing an entry in the MAC filter based on the result of applying a hash func- 

4 tion to the source MAC address; and 

5 storing the source MAC address at the indexed MAC-filter entry. 

1 11. (ORIGINAL) The method according to claim 9, wherein the received authentication 

2 request is an 802. IX authentication request. 

1 12. (ORIGINAL) The method according to claim 9, further comprising: 

2 sending an alarm message over the first logical subinterface' s dedicated network 

3 or subnetwork after the first client node fails to authenticate at the shared media port a 

4 predetermined number of times. 
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1 13. (ORIGINAL) The method according to claim 9, further comprising: 

2 sending an alarm message over the first logical subinterface's dedicated network 

3 or subnetwork after the first client node's authentication state changes from an authenti- 

4 cated state to an unauthenticated or unknown state. 

1 14. (ORIGINAL) An intermediate node for implementing port-based network access con- 

2 trol in a network containing a plurality of client nodes, the intermediate node comprising: 



3 a processor; 

4 a shared media port for receiving a data packet from a first client node in the plu- 

5 rality of client nodes; and 

6 a memory adapted to store instructions for execution by the processor, at least a 

7 portion of the instructions defining a network operating system configured to perform the 

8 steps of: 

9 partitioning the shared media port into a plurality of logical subinterfaces, 

10 each logical subinterface dedicated to providing access to a different network or 

1 1 subnetwork accessible through the intermediate node; 

12 associating the data packet received from the first client node with a first 

13 logical subinterface in the plurality of logical subinterfaces; 

14 determining whether the first client node is authenticated to communicate 
is over the network or subnetwork to which the first logical subinterface provides 

16 dedicated access; and 

17 forwarding the received data packet over the first logical subinterface's 

18 dedicated network or subnetwork only if the first client node is determined to be 

19 authenticated to communicate over that network or subnetwork. 

1 15. (ORIGINAL) The intermediate node according to claim 14, wherein: 

2 the memory is further adapted to store a MAC filter containing one or more en- 

3 tries configured to store at least a MAC address and an authentication state, and 

4 the network operating system is further configured to perform the steps: 
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5 receiving an authentication request from the first client node at the 

6 shared media port; 

7 copying a source MAC address stored in the received authentica- 

8 tion request into an appropriate entry in the MAC filter; 

9 forwarding the received authentication request to an authentication 

10 service; 

11 receiving a response from the authentication service, the response 

12 identifying an authentication state associated with the first client node; and 

13 storing the authentication state into the same MAC-filter entry into 

14 which the source MAC address was copied. 

1 16. (ORIGINAL) The intermediate node according to claim 14, wherein: 

2 the memory is further adapted to store an IP filter containing a list of IP addresses, 

3 and 

4 the network operating system is further configured to perform the steps: 

5 parsing a destination IP address from the received data packet; 

6 comparing the parsed destination IP address to one or more IP ad- 

7 dresses stored in an IP filter associated with the shared media port; and 

8 if the parsed destination IP address matches an IP address stored in 

9 the IP filter, forwarding the received data packet over the first logical sub- 

10 interface's dedicated network or subnetwork, even if the first client node is 

1 1 determined not to be authenticated to communicate over that network or 

12 subnetwork. 

1 17. (ORIGINAL) The intermediate node according to claim 14, wherein: 

2 the memory is further adapted to store a MAC filter containing one or more en- 

3 tries configured to store at least a MAC address and an authentication state, and 

4 the network operating system is further configured to perform the steps: 

5 parsing a source MAC address from the received data packet; 
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6 indexing an entry in a MAC filter associated with the shared media 

7 port based on the value of the parsed source MAC address; 

8 identifying an authentication state stored in the indexed MAC-filter 

9 entry; and 

10 determining whether the first client node is authenticated to com- 

11 municate over the first logical subinterface's dedicated network or sub- 

12 network based on the authentication state stored in the indexed MAC-filter 

13 entry. 

1 18. (ORIGINAL) An apparatus that implements port-based network access control at a 

2 shared media port, the shared media port being coupled to a plurality of client nodes, the 

3 apparatus comprising: 

4 means for partitioning the shared media port into a plurality of logical subinter- 

5 faces, each logical subinterface dedicated to providing access to a different network or 

6 subnetwork accessible through the intermediate node; 

7 means for receiving a data packet at the shared media port from a first client node; 

8 means for associating the received data packet with a first logical subinterface in 

9 the plurality of logical subinterfaces; 

10 means for determining whether the first client node is authenticated to communi- 
n cate over the first logical subinterface's dedicated network or subnetwork; and 

12 means for forwarding the received data packet over the first logical subinterface's 



13 dedicated network or subnetwork. 

1 19. (ORIGINAL) The apparatus according to claim 1 8, wherein the means for determin- 

2 ing whether the first client node is authenticated to communicate over the first logical 

3 subinterface's dedicated network or subnetwork further comprises: 

4 means for parsing a source MAC address from the received data packet; 

5 means for indexing an entry in a MAC filter associated with the shared media port 

6 based on the value of the parsed source MAC address; 
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7 means for identifying an authentication state stored in the indexed MAC -filter en- 

8 try; and 

9 means for determining whether the first client node is authenticated to communi- 

10 cate over the first logical subinterface's dedicated network or subnetwork based on the 

1 1 authentication state stored in the indexed MAC-filter entry. 

1 20. (ORIGINAL) The apparatus according to claim 1 8, further comprising: 

2 means for parsing a destination IP address from the received data packet; 

3 means for comparing the parsed destination IP address to one or more IP ad- 

4 dresses stored in an IP filter associated with the shared media port; and 

5 means for forwarding the received data packet over the first logical subinterface's 

6 dedicated network or subnetwork, even if the first client node is determined not to be au- 

7 thenticated to communicate over that network or subnetwork. 

1 21 . (ORIGINAL) The apparatus according to claim 1 8, wherein the means for associating 

2 the received data packet with the first logical subinterface, further comprises: 

3 means for locating an entry in a routing table configured to store routing informa- 

4 tion associated with the received data packet; and 

5 means for associating the received data packet with the first logical subinterface 

6 based on the contents of the routing-table entry. 

1 22. (ORIGINAL) The apparatus according to claim 18, further comprising: 

2 means for receiving an authentication request from the first client node at the 

3 shared media port; 

4 means for creating a MAC filter associated with the shared media port if the MAC 

5 filter has not already been created; 

6 means for copying a source MAC address stored in the received authentication 

7 request into an appropriate entry in the MAC filter; 
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means for forwarding the received authentication request to an authentication ser- 
vice; 

means for receiving a response from the authentication service, the response iden- 
tifying an authentication state associated with the first client node; and 

means for storing the authentication state into the same MAC-filter entry into 
which the source MAC address was copied. 

23. (ORIGINAL) The apparatus according to claim 22, wherein the received authentica- 
tion request is an 802. IX authentication request. 

24. (ORIGINAL) A computer-readable media including instructions for execution by a 
processor, the instructions for a method of implementing port-based network access con- 
trol at a shared media port in an intermediate node, the shared media port being coupled 
to a plurality of client nodes, the method comprising the steps: 

partitioning the shared media port into a plurality of logical subinterfaces, each 
logical subinterface dedicated to providing access to a different network or subnetwork 
accessible through the intermediate node; 

receiving a data packet at the shared media port from a first client node; 

associating the received data packet with a first logical subinterface in the plural- 
ity of logical subinterfaces; 

determining whether the first client node is authenticated to communicate over the 
first logical subinterface' s dedicated network or subnetwork; and 

if the first client node is determined to be authenticated to communicate over the 
first logical subinterface' s dedicated network or subnetwork, forwarding the received 
data packet over the first logical subinterface 's dedicated network or subnetwork. 
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